ttern - Free Web Hosting with PHP, MySQL and cPanel

16
the Web application to call the function read_message().
This function, like get_message_titles() first checks if the
user who is requesting the reading of a message is
logged-in and redirects the user if not. In the next step
the value of the GET parameter named ‘id’ is retrieved
(given that it exists) and filtered through the integer value
function. Thus, continuing with our previous example, if
the user clicks on the following link: http://example.com/
read_message.php?id=776, the $message_id variable of
the read_message function will contain the number 776.
In the next step, the message id is used to retrieve the
full message from the messages table and thus in this
example case the SQL query will be the following:
SELECT from,title,message FROM Messages where message_id = 776;
The Web application uses the data and prints it out as
HTML to the user. The user reads the message and is
happy. Or maybe not ?
Exploiting IT
Those of you who have a security-oriented mindset [4]
may feel a bit uncomfortable with the workings of the
Listing 2. A simple Python script which downloads and saves the �rst 1024 messages from the
import urllib
import os
os.mkdir("./messages")
for i in range(0,1024):
ATTACK PATTERN
previously described Web application. Sure, they check
for SQL injections whenever they use data coming-in
from the user but you feel that something is not quite
right...
Lets look closely at the read_message() function and at
the resulting SQL query. We saw that if a user clicks
on link http://example.com/read_message.php?id=776,
the Web application will use the id parameter to find and
retrieve the appropriate message. In fact, this is exactly
where the vulnerability lies-- the Web application
uses ONLY the id that the user provided as a means
of reading a message. For the user with user_id equal
to 11, the Web programmer assumed that he or she
can click only on the links provided by the get_message_
titles() function, thus only click on one of the following
links:
• http://example.com/read_message.php?id=776
• http://example.com/read_message.php?id=779
While it is true that only the these two links will be
available in his INBOX, nothing is stopping the
user from changing the id parameter to any value
current_message = urllib.urlopen("http://example.com/read_message.php?id=%d" % i)
out_file = open("./messages/%d.txt" % i,"w")
out_file.write(current_message.read())
out_file.close()
Listing 3. Adding authorization checks to the vulnerable SQL query
$result = mysql_query("SELECT * FROM Messages where message_id = {$message_id} and to= {$user_id}");
/* The rest of the code is the same with the original function*/
[...]
03/2011